Skip to content
NewA calmer, faster ZeroHour
Threat actorhighExploited in the wild

Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection

Kaspersky Securelistby GReAT ()2
Read at securelist.com
AI summary · glm-5.3Summaries by Vani AI

Project CAV3RN continues targeting Israel, using Google Apps Script C2 relays and DNS-based channel routing in a .NET NativeAOT framework.

Kaspersky Securelist documents the continuation of Project CAV3RN operations against Israel. The modular .NET NativeAOT framework uses Google Apps Script as a C2 relay and DNS-based C2 channel selection, blending command traffic with legitimate Google services to evade detection.

Key facts
  • Ongoing campaign targeting Israeli organizations
  • Google Apps Script abused as C2 relay
  • DNS-based C2 channel selection mechanism
  • .NET NativeAOT modular framework evades detection
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
c2-relaydnsespionagegoogle-apps-scriptisraelnativeaotproject-cav3rn

From the original article

Project CAV3RN targets Israel with Google Apps Script C2 relays and DNS-based routing. Modular . NET NativeAOT framework blends C2 traffic with legitimate Google services to evade detection.

Kaspersky Securelist

By GReAT · securelist.com

Read the full article at Kaspersky Securelist

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.